SURICATA

MIXED MODE : USAGE
1. Add iptables rules with NFQ/NFLOG target :
# we want to be sure not to cut off a webserver,
# but we want to inspect port 80
# Send other than 80 to iPS
–nft add rule filter forward tcp dport not 80 queue num 0
# Port 80 to IDS
–nft add rule filter forward tcp dport 80 log group 2
Iptables way :
–iptables -A FORWARD -p tcp ! --dport 80 -j NFQUEUE
–iptables -A FORWARD -p tcp –dport 80 -j NFLOG --nflog-group 2